CVE-2026-67291
Received Received - Intake

Heap Out-of-Bounds Read in FreeRDP

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67291
EUVD
EUVD-2026-51823

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.29.0 has a heap out-of-bounds read vulnerability in the glyph cache handling code. When processing a GLYPH_FRAGMENT_ADD update, the client reads a server-controlled fragment size without validating it fits within the received buffer. A malicious RDP server can exploit this by sending a short fragment with an oversized declared size, causing the client to read beyond allocated memory and crash.

Detection Guidance

This vulnerability can be detected by checking the FreeRDP version on your system. Run 'xfreerdp --version' or 'apt list --installed | grep freerdp' to verify if your version is 3.28.0 or lower. Network detection may involve monitoring RDP traffic for malformed glyph fragment packets.

Impact Analysis

This vulnerability allows a remote attacker controlling an RDP server to crash the FreeRDP client application, potentially leading to denial of service. It does not enable code execution or data theft but disrupts legitimate remote desktop sessions.

Mitigation Strategies

Immediately update FreeRDP to version 3.29.0 or later. Disable RDP services if not required. Restrict network access to RDP ports (3389/tcp) using firewalls. Monitor for suspicious RDP server connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67291. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart